We use a pair of Juniper Secure Access 4000 appliances operating in a cluster configuration for high availability to provide remote access to our internal web based applications. We utilize Juniper’s Windows Secure Application Manager (WSAM) to provide secure access to web based and non-web based applications where the core rewriting functionality of the SA4000 is too slow or incompatible with the application.

We’ve been planning to upgrade from 6.2R1 to 6.5R1 so we can support our Windows Vista 64-bit users, a population that seems to be growing rapidly these days now that resellers are shipping machines with 4Gb of memory requiring a 64-bit operating system.

Over the past week we’ve been working (along with Juniper) to confirm that upgrading from 6.2R1 to 6.5R1 won’t cause us any unforeseen problems. We’ve tested the upgrade on a spare SA4000 and found no problems worth mentioning on the appliance itself. We did, however, encounter problems with the client software. The Juniper Installer Service is designed to automatically upgrade itself and any associated Juniper software such as Windows Secure Application Manager (WSAM), Network Connect (NC) and Hostchecker. The Juniper Installer Service is critical because it allows non-Administrator users of the personal computer to upgrade the Juniper software without requiring Administrator access. When you have a large deployment with hundreds or thousands of users (especially where those users are outside of your managed environment) it is crucial that this process work flawlessly. It would seem that the upgrade process between 6.2R1 and 6.5R1 is broken. In some discussions with TJAC they didn’t seem surprised by the information yet I don’t ever recall reading anything in the release notes acknowledging that problem.

non-Administrator users

I tested the upgrade process and the client software didn’t upgrade itself properly when a user without Administrator rights connected to the appliance. The browser would just hang at /dana/home/starter0.cgi?check=yes trying to check for the presence of the Juniper Installer Service. After about 30 seconds the browser would try to start Windows Secure Application Manager (if it was configured to launch automatically) and hang again. After another 60 seconds the appliance would try to launch a Java applet to install the WSAM client which would fail because the user wasn’t an Administrator of the PC and didn’t have the proper rights to install the WSAM client software.

Administrator users

If a user with Administrator rights connected to the appliance the browser immediately prompted the user to install the Juniper Installer Service (ActiveX object).  The Windows Secure Application Manager (WSAM) also installed/upgraded itself without issue along with the Network Connect (NC) client. In short there were no issues with the upgrade so long as the user was an Administrator of the personal computer.

Solution

The solution to the problem with non-Administrator users is simple but a painful task depending on how diverse your user population might be. An Administrator of the personal computer must manually install the Juniper Setup Client (formerly called the Juniper Installer Service) onto the personal computer. Once that task is complete non-Administrator users can connect to the Juniper appliance and any remaining Juniper software components will be properly installed through the Juniper Setup Client even though the user is a non-Administrator and doesn’t specifically have rights to install software.

In a previous post I hinted that the WSAM client didn’t function properly in 6.5R1 on a Windows Vista 64-bit computer. That problem seems to have remedied itself although I’m not really sure what changed or what might have been broken in my initial testing. All subsequent testing shows that WSAM works fine from a Windows Vista 64-bit computer. There are some documented issues using the 64-bit version of Internet Explorer within Windows Vista so I would advise users stick to the 32-bit version for now.

Cheers!
Update: Wednesday September 30, 2009

I thought I would post an update since this article seems to be attacking a lot of attention around the net. Over the past three months we had around 1,900 different users login from almost 3,400 different machines (users are mobile). While the majority of issues have been resolved by un-installing the Juniper client software, rebooting and re-installing the client software there are a few that require some extra configuration and one that is currently broken. If you are running Nortel Internet Security 2009 or Norton 360 there is a unknown issues with the latest (GoLive update) version that will cause Windows Vista (Norton forums) to hang and Windows XP to blue screen. If you are using ESET NOD32 you’ll need to add specific exemptions for Internet Explorer and the Juniper programs, you can see a example to the left (click to enlarge).

I also had a brief discussion with JTAC this week in which I was told that the Juniper Installer Service and the Juniper Setup Client are two different pieces of software.  I’ll need to dig up some additional documentation to see if I can untangle that mystery.